IRS ERC 6-Year Audit + 20% Penalty: NC SMB Records Playbook

TL;DR: The IRS is deep into a multi-year Employee Retention Credit (ERC) enforcement campaign. Per the Frost Law ERC timeline as of the week ending July 4, 2026, roughly 20,000 remaining ERC claims are in various stages of IRS review — 3,000 under review, 4,100 pending payment or disallowance, 5,200 under audit, 6,100 awaiting response review, and 1,600 with Independent Appeals. The 2025 One Big Beautiful Bill Act (OBBBA) extended the IRS's audit window for Q3-Q4 2021 ERC claims to six years and layered on a new 20% penalty on erroneous refund amounts, per SCL Tax Law's OBBBA analysis. For NC small businesses that filed ERC claims — furniture manufacturers in the Triad, construction firms across the Piedmont, medical and dental practices, restaurants and hospitality operators — the question is no longer "will I be audited" but "when I am asked to substantiate the claim, can I actually produce the records?"

Key takeaway: ERC audit defense is 90% records and 10% argument. NC SMBs that filed pandemic-era ERC claims need to (a) confirm the physical and digital records that substantiate their claim are retained, retrievable, and tamper-evident, (b) migrate paper substantiation to an audit-defensible digital archive with retention labels and legal-hold capability, and (c) treat the six-year audit window as a records-retention floor, not a ceiling.

Need a two-week ERC records-readiness assessment before the next IRS letter arrives? Contact Preferred Data Corporation at (336) 886-3282 for a right-sized audit-defensible records review. BBB A+ rated, serving High Point, Greensboro, Winston-Salem, Charlotte, Raleigh, and the Piedmont Triad since 1987.

What Exactly Changed With the OBBBA and Why Does It Matter to NC SMBs?

The One Big Beautiful Bill Act, signed in July 2025, made two structural changes to the ERC enforcement environment.

Extended audit window on Q3-Q4 2021 claims to six years. Per SCL Tax Law's analysis and Bryson Law Firm's ERC red-flags summary, the IRS now has six years — not three — to audit ERC claims for the Q3 and Q4 2021 quarters. That means Q3 2021 claims remain auditable through 2027, and Q4 2021 claims through 2028.
20% penalty on erroneous refund amounts. OBBBA introduced a new 20% penalty applying to the amount of any improper refund on top of the requirement to repay the funds. A $150,000 ERC claim disallowed on audit now creates a $180,000 repayment obligation (the credit plus the 20% penalty), before interest.

The Ways and Means committee's OBBBA press materials framed the changes as targeting the aggressive ERC-mill promoters that filed hundreds of thousands of questionable claims during 2021-2023. In practice, the enforcement dragnet catches many legitimate NC SMBs that filed defensible claims but cannot now produce the records the auditor asks for.

The IRS's own ERC guidance page makes clear the IRS is closely reviewing tax returns claiming the credit, and the IRS's third-party promoter warning is being cited in ongoing enforcement letters.

What Records Does the IRS Actually Ask For in an ERC Audit?

The IRS auditor's records request in an ERC examination typically includes eight document categories. Every NC SMB that claimed ERC should be able to produce all eight within 30 days.

Original Form 941-X and any amended returns for the claim quarters.
Payroll registers and Form 941 for each quarter (base and amended).
Full-time employee counts documenting whether the SMB was a "small employer" (500 or fewer FTEs) or "large employer" for the applicable year.
Government orders documentation — copies of state, county, and municipal orders relied on to substantiate a full or partial suspension. For NC, this includes Governor Cooper's Executive Orders 116, 118, 121, 138, and successors, plus county public-health orders.
Suspension-of-operations narrative — the specific business activities suspended, the percentage of operations affected, and the timeline.
Gross receipts records if claiming the significant-decline-in-gross-receipts test — quarterly gross receipts for 2019, 2020, and 2021 in comparable form.
Related-party wage exclusions — records establishing which owner-employees and related family members had wages excluded from the ERC calculation.
PPP loan interaction records — the specific wages allocated to PPP forgiveness versus ERC to avoid double-dipping.

The most common NC SMB audit failure is not the underlying eligibility argument — it is that the SMB used an outside promoter who filed the claim but returned only the completed 941-X to the client, with no supporting documentation package. When the IRS letter arrives, the promoter is unreachable and the SMB has no records.

What Are the Five Highest-Impact Records-Readiness Actions NC SMBs Should Take This Quarter?

A Q3 2026 records-readiness playbook with five actions in decreasing order of universal applicability.

Confirm you have the underlying substantiation package, not just the 941-X. If your ERC claim was filed by an outside firm, request the full working-file package in writing. Most reputable promoters retain the records for 7 years; some have gone out of business or become unresponsive. If the package is unavailable, begin reconstruction now with your CPA — do not wait for the audit letter.
Migrate paper substantiation to a digital archive with retention labels. Executive orders, board meeting minutes, government notices, and payroll registers from 2020-2021 are frequently held in paper form or on retired laptops. Scan, index, and file everything to a Microsoft 365 SharePoint library with retention labels set to "IRS Audit — Retain 8 Years" (or equivalent in your DMS).
Establish tamper-evident storage for the substantiation package. Standard file-share storage does not prove records were not altered post-filing. Use SharePoint retention labels with a legal-hold trigger, or a purpose-built compliance archive (Microsoft Purview, Barracuda Cloud Archiving, Proofpoint Enterprise Archive). Tamper-evidence significantly strengthens the auditor's confidence in the substantiation.
Test retrieval before the audit letter arrives. Ask a colleague not involved in the original ERC filing to retrieve five specific documents from the archive within 30 minutes. If they cannot, the archive is not audit-ready.
Formalize a document-retention policy that covers the six-year OBBBA window. Most NC SMB retention policies pre-date OBBBA and default to 3-4 years for tax records. Update the policy to explicit 8-year retention for pandemic-era claims and reset backup-lifecycle rules to match.

Executed together, the five actions convert an ERC audit from a scramble into a routine substantiation exchange.

Records Retention: The 3-Year Default vs the OBBBA 6-Year Reality

The following table shows the mismatch between typical SMB retention practice and the OBBBA-adjusted reality for pandemic-era ERC claims.

Record Category	Typical SMB Practice	OBBBA Reality	Gap
Form 941 (quarterly)	4 years	6 years (Q3-Q4 2021)	2 years
Payroll registers	3 years	6 years	3 years
Executive orders / government notices	Not retained	6 years	6 years
Suspension-of-operations narrative	Not created	6 years	6 years
Gross receipts records	3-4 years	6 years	2-3 years
PPP-ERC wage-allocation records	Sometimes	6 years	Often complete gap
Board meeting minutes	5-7 years	6 years	Often OK
ERC promoter working files	Held by promoter	6 years (yours to produce)	Frequently complete gap

For most NC SMBs, the "OBBBA reality" column is a net-new records-retention obligation the SMB does not yet have systems to meet.

What Does an Audit-Defensible Digital Archive Actually Look Like?

A right-sized NC SMB compliance archive has five components.

Immutable storage with legal-hold capability. Microsoft 365 with Purview Records Management, SharePoint retention labels + preservation lock, or a third-party compliance archive. The key property: once locked, records cannot be edited or deleted, even by administrators.
Indexed retrieval with metadata tags. Every substantiation document tagged with claim quarter, document type, source, and IRS-request category. Retrieval time under 5 minutes for any single document.
Access logging. Every access to the archive logged with timestamp, user, and action. Standard audit trail for regulators and for internal control.
Offsite backup with tested restore. The primary archive backed up to an independent cloud region or offline media, with an annual documented restore test. Per PDC's business continuity guidance for NC manufacturers, the annual restore test is the highest-value BCDR exercise.
Documented chain of custody for the underlying source records — who scanned each paper document, when, with what device, and any changes made post-scan.

For a typical 20-100 seat NC SMB, the practical implementation is Microsoft 365 Business Premium + Purview E5 Compliance add-on, configured by an experienced MSP. Total cost is typically $25-$45 per user per month plus a one-time implementation of $6,000-$18,000.

Which NC SMB Verticals Face the Highest ERC Audit Risk?

Four verticals carry concentrated exposure and should be first in line for the Q3 records-readiness review.

Restaurant, hospitality, and food-service SMBs across NC. High absolute ERC claim amounts, complex "full or partial suspension" arguments tied to local health orders, and frequently high promoter involvement. Combined effect: high audit selection probability and thin substantiation packages.
Piedmont Triad furniture manufacturers and Charlotte-area contract manufacturers. Complex 2020-2021 operational disruption patterns, mixed PPP-ERC interactions, and materially large claim amounts that draw audit attention.
Construction and specialty trades. Jobsite closures under county-level orders, subcontractor payroll allocation questions, and PPP interaction issues. Also the vertical most likely to have used an aggressive ERC promoter.
Medical, dental, and behavioral-health practices — significant-decline-in-gross-receipts claims with complex insurance-reimbursement timing, plus HIPAA-compliant records management overhead that most practices did not extend to their ERC substantiation package.

For all four, the actionable move is the same: run the Q3 records-readiness assessment before Q4 renewals and holiday-season staffing constraints collapse the calendar.

Ready for a two-week ERC records-readiness assessment for your NC business? Contact Preferred Data Corporation at (336) 886-3282. Serving High Point, Greensboro, Winston-Salem, Charlotte, Raleigh, and the Piedmont Triad since 1987.

Frequently Asked Questions

How long does the IRS now have to audit my Q3 or Q4 2021 ERC claim?

Six years from the return-due-date, per the One Big Beautiful Bill Act as analyzed by SCL Tax Law. Q3 2021 Form 941 was originally due October 31, 2021, so the extended audit window runs through late 2027; Q4 2021 through late 2028. Q1 and Q2 2021 claims retain the standard three-year window from the amended-return filing date, though the IRS's active enforcement campaign is scoping many of those as well.

What is the OBBBA 20% penalty and when does it apply?

Per SCL Tax Law's summary, the OBBBA imposes a new 20% penalty on the amount of any improper ERC refund, layered on top of the repayment obligation itself. A $150,000 ERC claim disallowed on audit becomes a $180,000 obligation (credit + 20% penalty), before interest and other penalties. The penalty is designed to change the risk-reward math for aggressive claims.

My ERC promoter went out of business — how do I reconstruct the substantiation package?

Start with your CPA and your existing payroll provider. The core records — Form 941s, payroll registers, gross receipts records — should be reconstructible from the source systems. The harder categories (government orders, board minutes, suspension-of-operations narratives) require careful reconstruction with contemporaneous corroboration. Do not wait for the audit letter to start; the IRS's promoter warning page makes clear that promoter absence is not a defense.

How much does an audit-defensible digital archive actually cost?

For a 20-100 seat NC SMB, a Microsoft 365 Business Premium + Purview E5 Compliance archive typically runs $25-$45 per user per month, plus a one-time implementation of $6,000-$18,000. That cost is roughly 2-4% of a typical ERC claim amount, and it hedges the 20% OBBBA penalty risk on every dollar of the claim.

What is the single most-common ERC audit records failure?

Missing "government orders documentation" — the specific state, county, or municipal executive orders and public-health orders that the SMB relied on to substantiate a full or partial suspension. The orders themselves are still publicly accessible via NC Governor's office archives and county archives, but they need to be retrieved, indexed, and linked to the specific suspension periods claimed. Most NC SMB substantiation packages have narrative language about "COVID closures" without the underlying order citations.

Does PDC provide the tax advice for ERC audit response?

No — PDC is your technology partner, not your tax counsel. The tax argument and IRS correspondence are handled by your CPA or tax attorney. PDC's role is to make the substantiation records producible, retrievable, and audit-defensible, which is the technology half of the audit response. We commonly work in tandem with your existing CPA or tax counsel on the records-production side.